In February 2026, India quietly passed one of the most significant digital laws of the decade – the IT Rules Amendment 2026. If you’ve been following deepfake news in India, this is the legislation you need to understand. Here’s what changed, why it matters, and what it means for platforms, creators, and everyday citizens.
What Is the IT Rules Amendment 2026?
On 10 February 2026, India’s Ministry of Electronics and IT (MeitY) notified sweeping amendments to the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021. The updated rules officially came into force on 20 February 2026 and introduced a new category of regulated content: Synthetically Generated Information (SGI).
SGI covers any content – video, audio, image, or text – that has been materially altered or created using AI tools in a way that misrepresents reality or a real person’s identity. In plain language: deepfakes are now legally defined and regulated for the first time in India.
The 3-Hour Takedown Rule
The single most impactful change is the mandatory 3-hour takedown window. Significant Social Media Intermediaries (SSMIs) – platforms with more than 50 lakh registered users in India – must remove any reported SGI content within 3 hours of a verified complaint being lodged.
This applies to platforms like YouTube, Instagram, Facebook, X (formerly Twitter), and WhatsApp. The clock starts the moment a valid report is submitted through the platform’s official grievance mechanism.
Mandatory Watermarks and Digital Fingerprints
The amendment also mandates that AI-generated content must carry:
- A visible or embedded digital watermark identifying it as AI-generated
- Metadata tags (C2PA-style) embedded in the file at the point of creation
- A spoken audio disclaimer at the start of AI-generated video or audio content
These requirements apply to any Indian platform that uses generative AI tools to produce or distribute content. Non-compliance strips the platform of Safe Harbour protections under Section 79 of the IT Act.
The “Safe Harbour” Clause – And How You Lose It
Section 79 of the IT Act historically gave platforms immunity from third-party content liability – as long as they acted as neutral intermediaries. The 2026 amendment introduces a hard condition: failure to comply with the 3-hour SGI takedown obligation causes the platform to lose this immunity entirely.
This means the platform can be held legally liable for any harm caused by the deepfake content it failed to remove in time – including defamation, financial fraud, and reputational damage to the victim.
What This Means for Victims
If someone creates a deepfake of you – your face on a fake video, your voice in a scam call, your photo morphed and spread online – you now have a legally enforceable 3-hour removal right. Use it. File a formal complaint on the platform’s grievance portal. If the platform fails to act, you can escalate to MeitY’s Appellate Committee and pursue civil or criminal remedies.
Related Deepfake Guides
Related reading: The 2-Hour Race: How India’s 2026 IT Rules Are Changing the Fight Against Deepfakes
